Re: [PATCH] media: iris: Fix out-of-bounds read in timestamp metadata fallback

[Birk Skyum]

On Sat, 17 Oct 2026 08:55:04 +0530, Vishnu Reddy wrote:
> If iris_get_ts_metadata() finds no matching timestamp in that window,
> its fallback reads inst->tss[32], one entry past the end of the array.

I hit the same report on a Lenovo Yoga Slim 7x (X1E80100) while playing
video in Chromium, and it reproduces on demand: decoding a 64-frame
H.264 clip with ffmpeg's h264_v4l2m2m triggers it at the end of the
stream, while clips of 30 to 63 frames do not:

  UBSAN: array-index-out-of-bounds in drivers/media/platform/qcom/iris/iris_buffer.c:932:26
  index 32 is out of range for type 'iris_ts_metadata [32]'

With this patch on 7.2.8, 22 decodes of 30 to 192 frames (64, 96, 128,
160 and 192 among them) gave no report, and the 64- and 96-frame
decodes match a software decode frame for frame, timestamps included.

Tested-by: Birk Skyum <birk.skyum@xxxxx> # Lenovo Yoga Slim 7x (X1E80100)